Cross Site Scripting Vulnerability in Neve PRO Theme by Themeisle
CVE-2026-57618

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Neve Pro
Vendor
CVE Published:
26 June 2026

What is CVE-2026-57618?

The Neve PRO theme by Themeisle contains a Cross Site Scripting (XSS) vulnerability affecting versions up to 3.1.2. This flaw allows attackers to inject malicious scripts into web pages viewed by users. When exploited, it can lead to unauthorized actions taken on behalf of the users or unauthorized disclosure of sensitive information. Website administrators using the affected version should promptly update to mitigate the security risk.

Affected Version(s)

Neve PRO <= 3.1.2

References

https://patchstack.com/database/wordpress/theme/neve-pro-...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

João Pedro S Alcântara (Kinorth) | Patchstack Bug Bounty Program
.